Hi cphair I think, the problem ist that you loose the information from your base search when you pipe to localize so there is no host field left for the map command. If you already know which hosts you are looking for in the base search you can reuse them in the map search. I used sourcetype instead of host in this example: index=_internal source=*splunkd.log (sourcetype=splunkd OR sourcetype=scheduler) | localize | map search="search index=_internal (sourcetype=splunkd OR sourcetype=scheduler) starttimeu=$starttime$ endtimeu=$endtime$" You have to decide whether you want to loop over a list of hosts or a list of time ranges with the map command. But maybe I misunderstood your question ... View more

If record 4 is always the last record/event you are interested in you could try this: base search | stats last(_raw) by co_relation_id last(_raw) will give you the entire record/event if there is a specific field you are interested in you can use that instead of _raw An example using the _internal index of Splunk would be: index=_internal source="/opt/splunk/var/log/splunk/metrics.log" | stats last(_raw) as myraw by group If you do not want to display the co_relation_id (group in the example): index=_internal source="/opt/splunk/var/log/splunk/metrics.log" | stats last(_raw) as myraw by group | fields myraw ... View more

Yes if you use the transaction command a field called "eventcount" is added to your results. It is mentioned in the documentation of the transaction command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction ... View more

You just saved my day dwaddle, thx ... View more

You could setup, a Manager Role that inherits from every AppName_R role. aholzer's suggestion works as well but you can loop through the metadata/default.meta on the filesystem and add the additional role to the read stanza. ... View more

Good luck let me know if it does not work/isn't what you wanted ... View more

Thanks for replying, the indexer queues (SOS) seem to be ok, the 256KBps is not a problem either the forwarder has a thruput close to 0 for most of the time and then from time to time indexes its data(I don't see why it behaves like this). I see a couple of WARN TcpOutputProc - Raw connection to ip= :9997 timed out in splunkd.log of the forwarder. So it might be the network. I opened a case for the issue. ... View more

Thank you Nick, I updated the question ... View more

There is a comercial app that can help: http://www.prelert.com/products/anomaly-detective-for-splunk.html You could experiment with the trendline command: index=_internal earliest=-60m@m | timechart span=10m count(host) as count | trendline sma7(count) | tail 1 ... View more

You could append a "| where isnotnull(myDataField)" after the timechart command. But the resulting Graph could become difficult to read because the data points are not allways at the same intervall anymore. ... View more

You can customise the look & feel of your dashboards by using creating a custom css file. You have a css file for an entire app or a specific view http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/UseCSS To find out which styles you have to set in the css file you can use FireFox with Firebug installed and then right click on the button to see what styles apply to it. Depending on where your button is it could be something like: .SplunkModule.Button { float: right; } Good luck ... View more

Hi I just had a go at creating the kind of dashboard you wanted to create. The interesting part is at the end. The search i used to get information about the indexes ist: | rest /services/data/indexes count=0 | chart sum(currentDBSizeMB) by title You might have to use the splunk_server option if you have a distributed environment and only want to list indexes on specific splunk servers: | rest /services/data/indexes count=0 splunk_server=myserver | chart sum(currentDBSizeMB) by title <view stylesheet="dashboard2.css" template="dashboard.html"> <label>Summary</label> <module name="AccountBar" layoutPanel="appHeader" /> <module name="AppBar" layoutPanel="navigationHeader" /> <module name="Message" layoutPanel="messaging"> <param name="filter">*</param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="TitleBar" layoutPanel="viewHeader"> <param name="actionsMenuFilter">dashboard</param> </module> <module name="SearchBar" layoutPanel="splSearchControls-inline"> <param name="useAssistant">true</param> <param name="useTypeahead">true</param> <param name="useOwnSubmitButton">False</param> <module name="TimeRangePicker"> <param name="selected">All time</param> <param name="searchWhenChanged">False</param> <module name="SubmitButton"> <param name="allowSoftSubmit">True</param> <module name="ViewRedirector" layoutPanel="viewHeader"> <param name="viewTarget">flashtimeline</param> </module> </module> </module> </module> <!-- indexed data panels --> <!-- The first list of sources --> <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="true"> <param name="search">| metadata type=sources | search totalCount&gt;0 | rename totalCount as Count recentTime as "Last Update" | table source Count "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "Last Update"=strftime('Last Update', "%c")</param> <param name="maxCount">100000</param> <param name="earliest">rt</param> <param name="latest">rt</param> <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">Sources (%(count)s)</param> <!-- SPL-42701. Add back in later. <module name="PostProcessFilter"> <param name="prefixSearch">eval _raw=source</param> --> <module name="Paginator"> <param name="entityName">results</param> <param name="maxPages">10</param> <module name="SimpleResultsTable"> <param name="entityName">results</param> <param name="drilldown">row</param> <module name="HiddenSearch"> <param name="search">*</param> <module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="source">$click.value$</param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> <param name="uriParam.auto_pause">true</param> </module> </module> </module> </module> <!-- SPL-42701. Add back in later. </module> --> </module> </module> </module> <module name="StaticContentSample" layoutPanel="panel_row1_col1" group="All indexed data"> <param name="text">This lists all of the data you have loaded into your default indexes. &lt;a href="/manager/search/adddata"&gt; Add more data&lt;/a&gt;.</param> <param name="groupLabel">All indexed data</param> </module> <!-- The list of sourcetypes AND the top panel --> <module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="true"> <param name="search">| metadata type=sourcetypes | search totalCount&gt;0 | rename totalCount as Count recentTime as "Last Update"</param> <param name="maxCount">100000</param> <param name="earliest">rt</param> <param name="latest">rt</param> <module name="HiddenPostProcess" layoutPanel="panel_row1_col1"> <param name="search">| stats sum(Count)</param> <module name="SingleValue"> <param name="beforeLabel">Events indexed</param> <param name="format">number</param> </module> </module> <module name="HiddenPostProcess" layoutPanel="panel_row1_col1"> <param name="search">| stats min(firstTime) as min | eval min=strftime(min,"%c")</param> <module name="SingleValue"> <param name="beforeLabel">Earliest event</param> <param name="format">string</param> </module> </module> <module name="HiddenPostProcess" layoutPanel="panel_row1_col1"> <param name="search">| stats max(lastTime) as max | eval max=strftime(max,"%c")</param> <module name="SingleValue"> <param name="beforeLabel">Latest event</param> <param name="format">string</param> </module> </module> <module name="HiddenPostProcess" layoutPanel="panel_row3_col1"> <param name="search">table sourcetype Count "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "Last Update"=strftime('Last Update', "%c")</param> <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">Source types (%(count)s)</param> <module name="Paginator"> <param name="entityName">results</param> <param name="maxPages">10</param> <module name="SimpleResultsTable"> <param name="entityName">results</param> <param name="drilldown">row</param> <module name="HiddenSearch"> <param name="search">*</param> <module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="sourcetype">$click.value$</param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> <param name="uriParam.auto_pause">true</param> </module> </module> </module> </module> </module> </module> </module> </module> <!-- The list of hosts --> <module name="HiddenSearch" layoutPanel="panel_row3_col2" autoRun="true"> <param name="search">| metadata type=hosts | search totalCount&gt;0 | rename totalCount as Count recentTime as "Last Update" | table host Count "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "Last Update"=strftime('Last Update', "%c")</param> <param name="maxCount">100000</param> <param name="earliest">rt</param> <param name="latest">rt</param> <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">Hosts (%(count)s)</param> <module name="Paginator"> <param name="entityName">results</param> <param name="maxPages">10</param> <module name="SimpleResultsTable"> <param name="entityName">results</param> <param name="drilldown">row</param> <module name="HiddenSearch"> <param name="search">*</param> <module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="host">$click.value$</param> </param> </param> <module name="ViewRedirector"> <param name="viewTarget">flashtimeline</param> <param name="uriParam.auto_pause">true</param> </module> </module> </module> </module> </module> </module> </module> <module name="HiddenSearch" layoutPanel="panel_row1_col2" autoRun="true"> <param name="latest">now</param> <param name="earliest">-15m</param> <param name="search"><![CDATA[ | rest /services/data/indexes count=0 | chart sum(currentDBSizeMB) by title ]]></param> <module name="HiddenChartFormatter"> <param name="chart">pie</param> <param name="chartTitle">Index Sizes</param> <module name="JSChart" /> </module> <module name="SimpleResultsHeader"> <param name="entityName">results</param> <param name="headerFormat">Indexes (%(count)s)</param> <module name="Paginator"> <param name="entityName">results</param> <module name="SimpleResultsTable" /> </module> </module> </module> </view> ... View more

I'm assuming you're talking about this view at http://yourserver/en-US/manager/search/data/ui/views: The view/dashboard is in: $SPLUNK_HOME/etc/apps/search/default/data/ui/views/dashboard_live.xml You can go to the manager in the search app click "User Interface" and then "Views" there you see the dashboard_live you can clone it or edit it directly ... View more

This is doable got to the Manager click on "User Interface" and the views in your app for every view you can set the permissions for the roles you have in Splunk. You can create your own roles and assign the users to those roles. There is some info here http://docs.splunk.com/Documentation/Splunk/latest/Security/Addandeditroles But I think you should be fine be just copying the default user or power roles and assign the users accordingly ... View more

1.) No, Splunk can be installed on Windows. 2.) You can monitor the Windows Event log, if you want to Monitor a directory with files there are possibilities. 3.) Is easy if the ticketsystem writes log messages. There is an a Splunk App for Windows (http://splunk-base.splunk.com/apps/22315/splunk-app-for-windows) and a so calle technology add on which might be more interesting (http://splunk-base.splunk.com/apps/28933/splunk-for-windows-technology-add-on). 16-18h sounds like it is doable write me an email: sinloft@gmail.com and we can work things out. ... View more

I guess there are different ways to solve this depending on what you mean by analyzing the interface & connection. You could just check /var/log/messages or /var/log/syslog (on a Unix System) for events that indicate that an interface came up or went down and write a search to detect the situation and assume, that if the Interface is ok the connection is ok: Jan 25 13:10:02 host kernel: [2149765.760464] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX Jan 25 13:10:02 host kernel: [2149765.761220] ADDRCONF(NETDEV_UP): eth0: link is not ready Jan 25 13:10:02 host kernel: [2149765.761235] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready You could also write a script and set up a scripted input that verifies the connection ( using ping or telnet/nc or maybe wget for an http connection) and the creata a scripted input (easier) or a modular input: http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptSetup http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ModInputsIntro Or maybe the ticketing software will write error messages if there is a connection problem and you can use that information (or you could use all 3 methods) This app (or the windows pendant) are a good starting point there is a Dashboard called "Connection Details" that will populate if the app is configured correctly: http://splunk-base.splunk.com/apps/22314/splunk-for-unix-and-linux -> It is also a good example to see how scripted inputs work (see the inputs.conf file and check the bin directory withi its shell scripts). Is this the info you were looking for? Chris ... View more

Hm, correct me if I am wrong, but defining a defaultgroup, if it is just done once, should in this case apply for the entire forwarder that receives the app through the deployment server. The defaultgroup is then implicitly applied to all inputs. So a forwarder in City A will forward all its inputs to the indexers in City A. You can check the current config with "/opt/splunkforwarder/bin/splunk btool outputs list" but you probably already knew that. ... View more